GHSA-fmqq-hw9m-448q

Subrion CMS PHP Object Injection

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-12469

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	intelliants/subrion	<= 4.2.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a block to blocks/edit.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-12469 advisory
https://belong2yourself.github.io/vulnerabilities/docs/Subrion%20CMS/Insecure%20Deserialization/Subpages%20-%20Authenticated%20PHP%20Object%… web
https://github.com/belong2yourself/vulnerabilities/tree/master/Subrion%20CMS/Insecure%20Deserialization/Subpages%20-%20Authenticated%20PHP%2… web
https://github.com/intelliants/subrion package